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Law (BIICL), the Centre was brought into being to pursue Tom Bingham’s inspiring vision: a world in 
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judge of his generation, who crowned his judicial career by leaving us arguably the best account of what 
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significant Rule of Law issues of the day, both in the UK and internationally, including 
highlighting threats to the Rule of Law. 


e We make strategic, impartial contributions to policymaking, law making or decision-making in 
order to defend and advance the Rule of Law, making practical recommendations and 
proposals based on our research. 


e We hold events such as lectures, conferences, roundtables, seminars and webinars, to 
stimulate, inform and shape debate about the Rule of Law as a practical concept amongst law 
makers, policy makers, decision-makers and the wider public. 


e We build Rule of Law capacity in a variety of ways, including by providing training, guidance, 
expert technical assistance, and cultivating Rule of Law leadership. 


¢ We contribute to the building and sustaining of a Rule of Law community, both in the UK and 
internationally. 
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Questions 


e Howis the Rule of Law relevant in the introduction of new technologies? 

e What are the different conceptions of the Rule of Law? 

e What are the core elements of a functional definition of the Rule of Law? 

e What are the advantages and limits of using a Rule of Law lens when assessing the 
introduction of new technologies? 
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1. The Relevance of the Rule of Law for New Technologies 


Inherent in the introduction of any new technology is the potential for conflicts. In relation to the 
introduction of technologies for the management of COVID-19, concerns have been voiced that 
technologies may not necessarily be in everybody's best interests. In particular, COVID-19 
contact tracing apps, which should help identifying, through digital means, persons who may 
have been in contact with an infected individual have raised concerns about the negative impacts 
on fundamental freedoms, including freedom of association, and privacy. Contact tracing apps 
are just one example, but similar concerns may apply to other technological responses such as 
the use of surveillance cameras, facial recognition technologies etc. 


Several frameworks for building contact tracing apps have been developed and numerous 
applications have been developed or proposed, with a main distinction being drawn between 
centralized and decentralised contact tracing approaches.' The first uploads the anonymised 
data (of smartphone owners being close to each other; or other tracking device) into a remote 
server where matches are made with other contacts, should a person start to develop COVID-19 
symptoms. The second approach, instead, keeps the data on the phone, where the matches are 
made with people who may have contracted the virus. While both models have their supporters, 
the centralised model has prompted concerns about the likelihood of extended government 
powers over citizens, and negative impacts on their fundamental freedoms.” 


In democratic nation states, by reducing arbitrary exercise of power, the Rule of Law is an 
essential precondition for government legitimacy, albeit not the only one. During a period of 
emergency, when the powers available to government shift to enable them to deal with that 
emergency, it is essential to look back to what good law is about and why the Rule of Law is so 
important. As John Locke put it, law should serve “not to abolish or restrain, but to fundamentally 
preserve and enlarge freedom.”? 


The Rule of Law, in the writings of John Locke and Friedrich von Hayek,* among others, is bound 
up with theories about circumscribing the role of the sovereign in a modern State, and the 
position of the law in that process. Within this tradition, the Rule of Law rejects the use of 
arbitrary power, fundamentally constraining both individual and institutional behaviour. This type 
of approach implies that harms that we prevent through law during a non-emergency period, 
cannot suddenly be brought about just because we are facing a global pandemic. As 
emphasised by the European Court of Human Rights, “[even] in the framework of a state of 
emergency, the fundamental principle of the rule of law must prevail”.® 


This is the principle that motivates our emphasis on the Rule of Law during this period of 
immense upheaval. The Rule of Law provides a perimeter of legitimacy of the restrictive 
measures taken in response to a crisis or in an emergency situation. Put differently, responses to 
public emergencies (including data driven responses in the context of health emergencies) are 
often introduced and/or implemented through laws and regulations, which should be in 
compliance with Rule of Law principles. Adherence to Rule of Law safeguards and other 
international principles, when adopting measures during an emergency, are expected to 





1 See, among others, European Parliament Briefing, ‘National COVID-19 contact tracing apps’, May 2020, 
<https://www.europarl.europa.eu/RegData/etudes/BRIE/2020/65271 1/IPOL_BRI(2020)652711_EN.pdf>. 

2 Orla Lynskey, and Michael Veale, Written evidence to the UK Parliament, 6 May 2020, 

<https://committees. parliament.uk/writtenevidence/4090/html/>. 

3 John Locke, Two Treatises of Government, Second Treatise, Chapter 6 and Chapter 11 

4 Friedrich Hayek, Law, Legislation and Liberty, 1973. 

5 Piskin v. Turkey (no. 33399/18), 15 December 2020 (not final), para. 153. Citation from Robert Spano, ‘The rule of law as the 


lodestar of the European Convention on Human Rights: The Strasbourg Court and the independence of the judiciary’, 
European Law Journal, 7 January 2021, p. 5, <https://onlinelibrary.wiley.com/doi/epdf/10.1111/eulj.12377>. 





strengthen public trust in institutions and consolidate the legitimacy of the measures. This should 
ultimately bolster their effectiveness through increased compliance. 


2. Definition(s) of the Rule of Law 


This section sets out the different conceptions of the Rule of Law and how it applies in to 
COVID-19-related technologies. 


2.1. The ‘Thin’ and ‘Thick’ Conceptions of the Rule of Law 


The Rule of Law is comprised of separate, desirable, components. The table below shows the 
Rule of Law components as identified by main theorists in the literature.® 


Fuller Raz Finnis 

¢ Generality of law ¢ Laws are * Rules are 

¢ Promulgation prospective, open, prospective 

¢ No retroactive laws and clear ¢ Rules are possible 

¢ Clarity of laws ¢ Laws are relatively to comply with 

¢ No contradictions in the stable ¢ Rules are 
laws ¢ The making of promulgated 

¢ Laws do not require the particular laws is ¢ Rules are clear 
impossible guided by open, ¢ Rules are coherent 

¢ Relative constancy of laws stable, clear, and with one another 
through time general rules ¢ Rules are 

¢ Congruence between ¢ Independence of sufficiently stable 
official action and the judiciary must ¢ The making of 
declared rule be guaranteed degrees is limited 


Principles of Officials are 
natural justice must accountable for 
be observed compliance with 
Courts have review __ the rules 
powers over the 

implementation of 

the other principles 

Courts are easily 

accessible 

The discretion 

of the crime- 

preventing agencies 

is not allowed to 

pervert the law 


In the Anglo-American tradition, the Rule of Law is an ideal which contains, at its core, a number 
of basic principles. Thin versions of the Rule of Law, from within this tradition, concern how any 
given law is made and applied. The ‘thin’ conception includes the requirement that States make 
clear laws, that they do so in a transparent manner, that the law is equally applied, and that 
States enable fair and impartial dispute resolution and access to justice. 





8 LonL Fuller, The Morality of Law: Revised Edition. Yale University Press, 1969. JSTOR, www.jstor.org/stable/j.ctt1cc2mds. 
Accessed 17 Mar. 2021; Joseph Raz, The Rule of Law and its Virtue, 
https://www.researchgate.net/publication/329711055_The_Rule_of_Law_and_its_Virtue, 1979, 


https://www.researchgate.net/publication/329711055 The Rule of Law and its Virtue; John Finnis, Natural law and natural 
rights, OUP, 1980. 











In practical terms, this conception ensures that if an introduced technology engages a particular 
requirement in the existing corpus of law’, the relevant law is applied to the governance of that 
technology. A prime example here would be privacy laws, or data protection laws being used in 
the governance of a data-dependent technology. 


At the opposite end of the spectrum is the “thick” Rule of Law, which moves beyond procedural 
safeguards to also consider the content of the law. In this view, the Rule of Law requires state 
compliance with international law, and adequate protection of fundamental human rights. 
Broader understandings of the Rule of Law, such as those expounded by the Council of Europe’s 
(CoE) Venice Commission (VC),’ the United Nations® and Lord Bingham’s definition,? proscribe 
arbitrary behaviour by governments and protect human rights, in addition to the formal aspects of 
the Rule of Law, as set out above. 


The table below shows how the constituent parts of the Rule of Law vary according to whether 
the concept is defined in a ‘thin’ or ‘thick’ manner. 


Thin —_—_ Thick 
Rule by law Legality Rights conception Democratic 
conception 
Government action is Government action is Government action is Government action is 
justified by the law. justified by the law. justified by the law. justified by the law. 


Generality, formal Generality, formal Generality, formal 
equality, publicity, equality, publicity, equality, publicity, 
prospectivity, prospectivity, prospectivity, 


consistency, clarity, consistency, clarity, consistency, clarity, 
stability, congruence. stability, congruence. stability, congruence. 


Independence of the Independence of the Independence of the 

judiciary, principles of | judiciary, principles of | judiciary, principles of 

natural justice, judicial | natural justice, judicial | natural justice, judicial 

review, access to the review, access to the review, access to the 
courts. courts. 


Justification, Justification, Justification, 
procedural principles, procedural principles, procedural principles, 
and reasonability. and reasonability. and reasonability. 
Civil and political Civil and political 
rights. Sometimes also | rights. Sometimes also 
economic, social and economic, social and 
cultural rights. cultural rights. 





Thin conception of 
democracy. 


Beyond the theoretical modulations of the meaning of the Rule of Law, the core elements that 
constitute the principle, such as stability, predictability, intelligibility of the laws, limitation of 
discretion and abuse of power, equality before the law, and access to justice are shared across 





7 Rule of Law Checklist’ adopted by the Venice Commission at its 106th Plenary Session (Venice, 11-12 March 2016). 

8 Report of the Secretary-General, ‘The rule of law and transitional justice in conflict and post-conflict societies’, 23 August 
2004, S/2004/616, at para 6, available at <http://undocs.org/en/S/2004/616>. 

9 Tom Bingham, The Rule of Law, Penguin Books, 2011, 84. 





jurisdictions, despite the contextual specificities of each country, hence the universality of the 
Rule of Law.'° In the words of Judge Spano:" 


“(...) the rule of law is not a legal principle which is limited to Western liberal 
democracies. Quite the contrary, it is a norm and a foundational ideal that 
transcends borders, traditions and cultures. The rule of law constitutes a core 
feature of any truly democratic system of communal human life regulated by legally 
binding norms. (...) Recall in this regard that the United Nations' Universal 
Declaration of Human Rights, with its direct reference to the rule of law in its 
Preamble, which lies at the origins of the Convention, is itself a global instrument 
guiding all 192 Member States of the United Nations.” 


Adding a Rule of Law frame to the analysis of COVID-19 related technology demands that 
governments provide legal justification for any measures that risk encroaching on rights, 
including privacy, free movement, and assembly, among others. The advantage of incorporating 
a thick Rule of Law perspective that encompasses human rights ensures that governments, and 
third parties can be held to account for decisions that risk circumscribing freedoms. It creates a 
space for questioning the rationale and justification for the introduction of technologies with 
potentially adverse effects on citizens. 


A Rule of Law approach towards the appraisal of lockdown technologies is useful because the 
values that underpin the Rule of Law ensure that power is held to account. In any political 
community under pressure, such as the immense pressure created by lockdown, finding 
mechanisms to make power less arbitrary, unpredictable and coercive is essential.'* It is during 
times of such instability that what Fuller calls the bond of reciprocity'’ - the bond between the 
ruler and the ruled - becomes so important. 


2.2. A Functional Definition of the Rule of Law 


The Council of Europe, which is founded upon the Rule of Law,'* has provided guidance as to 
the content of the Rule of Law, both in the case law of the European Court of Human Rights, '® 
and in the activities of a number of its bodies and monitoring mechanisms. The work of the 
Venice Commission, an advisory body of the Council of Europe, is particularly relevant in 
clarifying and streamlining the meaning of the Rule of Law as a concept of universal validity. 


The 2011 Venice Commission ‘Report on the Rule of Law’ proposed a functional non-exhaustive 
(‘thick’) definition of the concept,'® drawing on the definition proposed by British Judge, Lord 
Bingham."” In 2010, Lord Bingham had grasped the essence of the principle to be ‘that all 





10 On the Rule of Law as a universal principle see Joseph Raz, ‘The Law's Own Virtue’, (2019) 39(1) Oxford Journal of Legal 
Studies, p. 4. 

11 Robert Spano, ‘The rule of law as the lodestar of the European Convention on Human Rights: The Strasbourg Court and the 
independence of the judiciary’, European Law Journal, 7 January 2021, p. 5, 
<https://onlinelibrary.wiley.com/doi/epdf/10.1111/eulj.12377>. 

12 In Krygier’s teleological account of the Rule of Law there are three modes of exercising power that make people vulnerable 
to arbitrary treatment. Power is arbitrary when it is uncontrolled, unpredictable and/or unrespectful. Martin Krygier, ‘The Rule of 
Law and State Legitimacy’ in Martin Krygier, Legitimacy (Oxford University Press 2019) 
https://oxford.universitypressscholarship.com/view/10.1093/0s0/9780198825265.001.0001/os0-9780198825265-chapter-7 

13 Lone Fuller, The Morality of Law: Revised Edition. Yale University Press, 1969. JSTOR, www.jstor.org/stable/j.ctt1cc2mds. 
Accessed 17 Mar. 2021. 

14 Statute of the Council of Europe, London, 5.V.1949, http://www.coe.int/en/web/conventions/full-list/- 
/conventions/rms/0900001680935bd0. 

18 Fora summary see L. Pech and J. Grogan, ‘Meaning and Scope of the EU Rule of Law’, RECONNECT deliverable 7.2, p. 
28-35. The Bingham Centre contributed Section 3 on the Council of Europe legal framework. 

16 Venice Commission, ‘Report on the Rule of Law’ CDL-AD(2011)003rev-e, 
http://www.venice.coe.int/webforms/documents/?pdf=CDL-AD(2011)003rev-e, 














17 Tom Bingham, The Rule of Law (Penguin Books 2011) 84. 





persons and authorities within the state, whether public or private should be bound by and 
entitled to the benefit of the laws publicly made, taking effect (generally) in the future and publicly 
administrated in the courts’.'8 The Venice Commission's report identified a consensus on six 
necessary elements of the Rule of Law. These were further distilled into five, in the Venice 
Commission’s 2016 ‘Rule of Law Checklist’, making clear that respect for human rights informs 
the other elements: ‘The Rule of Law would just be an empty shell without permitting access to 
human rights. Vice-versa, the protection and promotion of human rights are realised only through 
respect for the Rule of Law’.'9 


The Checklist, developed with the help of the Bingham Centre for the Rule of Law, was adopted 
in March 2016. Each of the five Rule of Law elements in the Checklist is accompanied with 
practical benchmarks which are intended to serve as a useful tool for assessing adherence to the 
Rule of Law within a state in a manner that is ‘objective, thorough, transparent and equal’.2° 


Lord Bingham’s definition Mom c) Xela me (=e) VC Checklist definition 





(1) | Law not discretion Legality (transparent, Legality 
accountable, and democratic 
process for enacting law) 














(2) | Accessibility of laws Legal certainty Legal certainty 
(3) | Reasonable exercise of power Prohibition of arbitrariness Prevention of abuse (misuse) of 
for the purposes which it was powers 
conferred 
(4) | Equality before the law Non-discrimination and equality | Equality before the law and non- 
before the law discrimination 
(5) | Accessible dispute resolution Access to justice before Access to justice 


independent and impartial 
courts, including judicial review 
of administrative acts 





— 
Q 
aS 


Protection of human rights Respect for human rights 





Fair trial 


o 





The Rule of Law in the 
international legal order 


@ 




















The strength of the functional approach to the Rule of Law adopted by the Venice Commission is 
proved by the wide acknowledgement, use of and adherence to this approach by the 47 
Members of the Council of Europe and 15 other States, as well as by different Council of Europe 
and EU institutions, which substantiate the claim that ‘there is now a consensus on the core 
meaning of the rule of law and the elements contained within it’.2" 


The elements of the Venice Commission definition, as analysed in more detail below, offer a 
useful paradigm for the appraisal of new technologies, especially if these are introduced during a 
time of emergency. The consensus over the formulation of the core Rule of Law elements, 
however, does exclude the need to contextualise their application, so as to take the social and 
cultural backgrounds into account. 





18 Ibid., p. 8. 

19 ‘Rule of Law Checklist’ adopted by the Venice Commission at its 106th Plenary Session (Venice, 11-12 March 2016), 
http://www.venice.coe.int/images/SITE%20IMAGES/Publications/Rule_of Law Check _List.pdf. 

20 See A Drzemczewski, ‘The Council of Europe and the Rule of Law: Introductory Remarks regarding the Rule of Law 
Checklist Established by the Venice Commission’ (2018) 37 Human Rights Law Journal 179. 


21 Venice Commission, ‘Report on the Rule of Law’ CDL-AD(2011)003rev-e, para 35. 





(i) Legality 


The legality principle requires that State action is carried out in accordance with transparent and 
democratically enacted laws, not mere discretion. It also requires that the process for enacting 
laws is transparent, democratic, and subject to scrutiny. Not only States, but also hybrid or 
private parties are subject to the Rule of Law when performing public tasks. 


When applied in practice, the legality principle requires a legal basis for action, but not 
necessarily the enactment of new laws. The existing legal basis on which States usually 
introduce new healthcare technologies may be sufficient. Therefore, the opportunity for scrutiny 
and democratic participation 


will depend on a number of The Principle in Practice 
factors, such as whether new 


laws are introduced or based The Indian CT app Aarogya Setu was introduced as mandatory for 
on existing legislation; the Government and private sector employees. The app has been 

form of law-making through defined as “utterly illegal” and has been criticized for being mandated 
Which ihe measures-are without a proper legal basis and in a discretionary manner. 


introduced (e.g., executive The Indian Constitution requires that violations or restrictions of rights 
decree or primary legislation); be established in the law, and the introduction of the app by the 
, government has raised concerns over a trend of ‘rule by executive 


or the extent of collaboration i : : 
decree’, during the pandemic. 


with private parties. The - 

essence of the legality Source: Gautam Bhatia, The Mandatory Imposition of the Aaroaya Setu 

principle is that proper App Has No Legal or Constitutional Basis, 4 May 2020; Mandating Use 
. a Of Aarogya Setu App ‘Illegal’, Justice B N Srikrishna Raises Concerns 

scrutiny and accountability Over Controversial App, 12 May 2020. 

should not be bypassed by 


outsourcing to private parties. 








. South Korea, instead, is a good example, where almost all 
As earlier noted, a Rule of measures introduced have been supported by a legal basis and 
Law approach towards the positive law. Moreover, it is worth noting that South Korea did not 
appraisal of new technologies trigger its emergency law. 


is useful because it ensures Source: A comprehensive survey of authority, powers and control 
that power is held to account, measures related to COVID-19 in South Korea has been carried out by 
and thus enhances the Centre for Artificial Intelligence and Data Governance (CAIDG) and 


legitimacy. This will occur for will be soon available here. 

instance through scrutiny 

mechanisms, including ex-ante mechanisms, exposing the absence of a legal basis, lack of 
compliance with procedural rules for law-making, or lack of democratic accountability. However, 
in practice, ensuring the appropriate level of scrutiny amid a public emergency might be a 
challenging task. 


(ii) Legal Certainty 


As a component of the Rule of Law, legal certainty requires accessible, intelligible, clear, 
predictable and prospective laws, as far as this is possible. In the criminal law sector, the legal 
certainty principle involves compliance with the no punishment without law (nulla poena sine 
lege) principle. 


When applied in practice, the principle has prompted calls for an explicit (new) clear legal basis 
for Contact Tracing (CT) apps, rather than relying on and using existing legislation. A clear legal 
basis would ensure that powers exercised are not uncontrolled or unpredictable. In the UK, for 
instance, when considering the introduction of the new app (which nevertheless did not take 
place) it has been put forward that “Government assurances about intended privacy protections 
for any data collected do not carry any weight unless the Government is prepared to enshrine 





these protections in The Principle in Practice 
legislation. A Bill would 


provide necessary legal In the UK, the Health Secretary has stated that: 
clarity and certainty as to how 


data gathered could be used, 
stored and disposed of. It 





Existing legislation (especially the Data Protection 
Act 2018 and the Human Rights Act 1998), our 


commitment towards transparency, and the 





would also increase commitments | have previously set out ensure high 
confidence in the app, levels of security and privacy, and will provide the 
increase uptake, and improve public with the right protection and give them clarity 


efficacy.”2 and confidence to download and use the app. 


: ‘ Source: Letter to Rt Hon Harriet Harman MP, 21 May 2020 
Penalties for misuse or non- a a a 


use of apps have been 


introduced and enforced in Singapore launched the TraceTogether app in March 2020, which 
some cases (e.g., United uses Bluetooth to ping close contacts. As an alternative to the 
Arab Emirates) ,?° being smartphone app, the government also offers TraceTogether tokens. 


With a very broad app acceptance rate (almost 80%), citizen 
disquiet emerged in early 2021 as a result of announcements made 
to the public that data collected from TraceTogether can be 
retrieved by the Singapore police. 


provided for in the legislation. 
Appropriateness of penalties 

can nevertheless, in principle, 
be challenged for compliance 


: : As aresponse, the government passed new laws guaranteeing that 
with human rights. p 9 p g g 


data can only be accessed for investigation or criminal proceedings 
Compliance with the legal relating to serious offences laid out in the COVID-19 (Temporary 
certainty principle, however, Measures) Act. 

rests on a delicate Source: Kirsten Han, Broken promises: How Singapore lost trust on 
equilibrium. On the one hand, — contact tracing privacy, 11 January 2021. 

in emergencies, we see more 

rapid State action where responses can rely on existing legislation. To ensure this, States need 
to legislate at a level of generality which leaves room for their approach to evolve and be 
adjusted rapidly, without making the law excessively vague and unclear. On the other hand, a 
new legal basis may provide certainty, but the risks are that it could be overly specific and 
become rapidly outdated, or that it leads to unclear duplication of the relevant law. The Rule of 
Law does not dictate one “best path” for States in this regard and the right equilibrium should be 
guided by the context. 





(iii) © Prevention of Misuse of Powers 


The prevention of misuse of powers component of the Rule of Law requires that executive power 
is exercised in good faith, fairly and within the limits for which it was conferred. Limiting executive 
misuse of powers during an emergency is a particular challenge for courts and legislatures, but 
this is precisely where the Rule of Law operates as safeguard and should best inform responses 
to the emergency. As highlighted in the Venice Commission’s Rule of Law Checklist “State 
security and public safety can only be effectively secured in a democracy which fully respects the 
Rule of Law.” The scope of the Rule of Law in this regard does not (should not) alter during a 
crisis. 





22 UK Parliament, Joint Select Committee on Human Rights, ‘Human Rights and the Government's Response to Covid-19: 
Digital Contact’, https://publications.parliament.uk/pa/jt5801 /jtselect/jtrights/343/34302.htm. 

23 Norton Rose Fulbright, Contact tracing apps in United Arab Emirates. A new world for data privacy, 
https://www.nortonrosefulbright.com/-/media/files/nrf/nrfweb/contact-tracing/uae-contact-tracing.pdf?revision=15694ff9-c6c0- 





4419-81e0-b89600c54356&la=en-za 





The Rule of Law requires that emergency public powers are only used amidst emergencies. 
Thus, when applied in practice, the prevention of misuse of powers principle requires that if an 
app is part of a long-term response, it should not rely on an emergency legal basis. 


The principle also requires judicial and legislative oversight of the use of powers. 


For the courts, this requirement feeds | Shyer ates 
into the access to justice component 
and the concerns about the viability The Israeli Security Agency conducted electronic contact 


of judicial review/ ultra vires tracing without explicit statutory authorisation, acting under 
challenges to executive action during its general power (in s.7A of the ISA Law) to ‘protect and 

a public health emergency. advance essential national security interests’ 
Parliaments must also continue to The Israeli Supreme Court held that at this point in the 
debate, scrutinise, and explain the crisis, such general authority no longer sufficed to 
intended use of executive powers. authorise intrusive electronic surveillance. While the action 


was initially lawful, circumstances had now changed such 
that continued reliance on these powers was 
unconstitutional. 


Depending on context, media scrutiny 
may assist Parliamentary scrutiny 


(where it faces disruptions) but it is 

not an adequate substitute and Source: Elena Chachko, The Israeli Supreme Court Checks 
. COVID-19 Electronic Surveillance, 5 May 2020. 

fundamentally lacks the authority to 


provide monitoring of the use of 
executive powers. 





In relation to data-driven emergency responses, fair and bona fide exercise of the public power to 
collect sensitive health data will functionally overlap with privacy principles (e.g. purpose 
limitation may be introduced in the law to ensure that powers are not used for ulterior objectives). 


(iv) Non-discrimination, Equality Before the Law and Compliance with Human 
Rights 


This component implies that the Rule of Law can only be fully realised in an environment that 
respects and protects human rights. The laws should refrain from discriminating against 
individuals or groups and should guarantee equal and effective protection against discrimination 
on any ground such as race, colour, sex, language, religion, political or other opinion, national or 
social origin, property, birth or other status. Related to this, equality before the law involves that 
all individuals should are subject to the same laws, with no individual or group having special 
legal privileges. 


In the context of data-driven The Principle in Practice 
responses to public health 


emergencies, measures should The Polish app, Kwarantanna domowa, does not seem to 


strike the right balance between comply with the proportionality requirement that measures 
specific conflicting rights, such as taken should be the least restrictive of HRs as is possible. Are 
the right to liberty, freedom of these measures necessary for the app to be effective? 
movement, the right to work, Data is retained for 6 years, stored on a centralised server, 
manifestation of religion, privacy, and uploaded automatically. It can be accessed by the Health 
non-discrimination and the right to Department, the State IT Department, and the Police. 

life and health. There is no one Source: Norton Rose Fulbright, Contact tracing apps in Poland, 2 





solution fits all in this regard, rather February 2021. 

decisions can be driven by respect 

of contextual differences. However, 

in finding such balance, governments should be guided by and respect the general principles of 
necessity and proportionality and opt for the least rights-intrusive measure. 





In relation to the introduction of apps as a public health emergency-related tool, the principle is 
particularly relevant in relation to interferences with the right to privacy. Privacy principles 
governing the collection of data have been elaborated extensively by some legislatures (e.g., 
Australia, Canada, Germany, Hong Kong, Russia, the United Kingdom etc.).*4 The most 
significant elements are voluntariness, purpose and time limitation and data minimization. In 
some cases, the app itself may operate in a discriminatory manner, through digital exclusion, 
particularly for older and disabled people, or by preventing access to work, to public places or to 
certain services for those who do not use the app (e.g., debate in France).?° In other cases, the 
app may exacerbate existing discrimination in society, such as for instance against LGBT 
community in South Korea, following the Coronavirus outbreak in queer communities,?° or 
against BAME communities in England.?” 


General principles mandate continual assessment of the suitability and effectiveness of apps in 
the fight against COVID-19. In theory, if the app is not effective enough (due to lack of 
participation or design flaws), the intrusion on privacy rights will cease to be justifiable. While 
harnessing the resources of private parties may make States’ responses more effective 
throughout the populace, this may come at the cost of a trade-off in terms of trust and a risk of 
interference with human rights. Similar concerns about the necessity/justifiability/effectiveness of 
the app (the proportionate balance between health security and privacy) may arise when case 
numbers fall substantially. 


(v) Access to Justice 


Access to justice requires that everyone should be able to challenge governmental actions and 
decisions adverse to their rights or interests. Prohibitions of such challenges, or unavailability of 
an effective remedy will not meet the Rule of Law requirements. Courts have a vital function during 
and after the pandemic and the legal system should continue to provide fair and effective means 


f di resolution. 
of dispute resolutio The Principle in Practice 
In relation to data-driven 


responses to public health In China, many users of Alipay’s Health Code app have 
emergencies, including apps, the complained that the means by which it assigns a Health 
principle applies at (at least) two classification (Green, Yellow, Red) is opaque and error-prone, 
levels. First, operationally, there produced by an algorithmic black box. 

must be a means to challenge Officials have been quoted telling false positive users “Wait, 
false positives produced by the and don’t be nervous” but no clear means are provided to 


challenge the classification or its consequences. As a result the 
app can potentially lead to arbitrary, unchallengeable limitations 
of personal freedoms, including the freedom of movement. 


app, malicious conduct by other 
users etc. This may involve 
dispute resolution between 
citizens, and the State, and other 
private parties (e.g., tech 
companies). In this latter regard, 
app-based challenges can provide 


Source: Paul Mozur, Raymond Zhong and Aaron Krolik, In 
Coronavirus Fight, China Gives Citizens a Color Code, With Red 
Flags, 1 March 2020. 








24 Norton Rose Fulbright, Contac tracing apps: A new world for data privacy, https://www.nortonrosefulbright.com/en- 
it/knowledge/publications/d7a9a296/contact-tracing-apps-a-new-world-for-data-privacy . 

25 Norton Rose Fulbright, Contac tracing Apps, a new world for data privacy, France, httops://www.nortonrosefulbright.com/en- 
it/knowledge/publications/d7a9a296/contact-tracing-apps-a-new-world-for-data-privacy#France. 

26 Tracing homophobia in South Korea’s coronavirus surveillance program, 18 June 2020, https://theconversation.com/tracing- 
homophobia-in-south-koreas-coronavirus-surveillance-program-139428 

27 Public Health England ‘COVID-19: understanding the impact on BAME communities’ 
https://www.gov.uk/government/publications/covid-19-understanding-the-impact-on-bame-communities; JCHR ‘The 
Government’s response to COVID-19: Human rights implications’ https://committees.parliament.uk/work/218/the-governments- 
response-to-covid19-human-rights-implications/publications/. 














10 





a quick and inexpensive remedy, but they cannot be considered sufficient and a substitute to 
court remedies, especially when the measures introduced result in human rights limitations. 
Human rights are only effective through access to dispute resolution, whether formal or informal. 
Secondly, judicial (or similar) review of executive action imposing the app or for misuse of 
powers in relation to data collection should be possible and accessible to citizens. Principles of 
access to justice and fair dispute resolution remain relevant even when courts are temporarily 
closed. 


3. Assessing Technologies for Managing the Pandemic in the 
Light of Rule of Law Principles 


At each stage of the lifecycle of a new technology, analysis from a Rule of Law perspective is 
relevant.*8 The graph below summarises such elements of relevance through the different stages 
of the introduction and implementation of data-driven technologies over the course of the 
emergency. 





























After the 
emergency 


acelielel meni 
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Private sector 
partner 
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Introduction Technology in 
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RoL analysis of 
law / governance 
arrangements 
around 
partnership. 


(i) RoL analysis of 
legislative powers 
governing the new 
technology. 


(i) Ongoing 
oversight of the 
efficiency and 
proportionality of 
technology? 


Are measures 
still justifiable? 
What happens to 
the data 
collected? 


Oversight / 
review of 
technology 
rollout? 


(ii) Use of Impact 
Assessments? 








(ii) Access to 
justice, including 
remedies in the 
event of a breach? 


Moreover, a Rule of Law analysis is also relevant for the technology ecosystem, because 
pandemic technologies are embedded in wider digital architectures. Indeed, analysis of threats to 
the Rule of Law should go beyond looking at the specific technology — to consider all levels of 
activity: data collection and use, sharing, and the design, development and deployment of 
automated systems for analysis. In these regards, the presence and role of independent 
oversight mechanisms are paramount. To be effective such bodies should be endowed with 
sufficient powers (e.g., including ability to receive individual complaints) and adequate sufficient 
resources to carry out their functions. Also, particular safeguards should apply to minors, and 
collection and use of data regarding children should be specifically monitored. 





28 While outlined here in relation to the introduction of new technologies, the framework can also be 
used with regard to other types of responses. 





Treatment and sharing of 
insights from system with 
(a) wider government 
and (b) third-parties 


Properties of the 
wider system into 
which app is 
embedded 


Data architecture 
and sharing 
arrangements to 
support technology 


Design and 
development of the 
COVID-19 
technology (e.g. CT 
app) 


4. Review: Advantages and Limits of Using a Rule of Law Lens 
When Assessing the Introduction of New Technologies 


(i) What Does a Rule of Law Lens Bring? 


When introducing new technologies (including (intrusive) surveillance technologies) it is essential 
that governments comply with and apply Rule of Law safeguards. Three main arguments support 
this statement. First, a strong reason for advancing Rule of Law as an ancillary regulatory 
approach to ethics and principled design is that, as explained above, there is now a (quasi) 
universal consensus on the core meaning of the Rule of Law and on the elements constituting it. 
As such, a Rule of Law regulatory paradigm presents the advantage of being universally 
accepted. 


Secondly, the Rule of Law and its components operate as legitimators of government responses, 
thus potentially enhancing trust outcomes. 


The third important reason is that the Rule of Law offers the institutional and process potentials 
for enforceability, actionability and remedy if ethics are breached or fail, as clarified in the 
discussion of the Rule of Law components made above. 


(ii) | Why Opt for a ‘Thick’ Definition? 


As regards the conceptualization of the Rule of Law, it is important to refer to functional/outcome- 
oriented definitions such as that developed by the Venice Commission. ‘Thin’ definitions, based 
on formal legality, are less likely to temper arbitrary powers, and therefore may result being 
insufficient in terms of guaranteeing legitimacy, confidence, and trust in relation to the 
introduction of surveillance technologies. By resting on a narrower conception of formal legality, 
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‘thin’ conceptions do not consider aspects such as Human Rights, popular consent and 
compliance with international legal obligations in law-making. 


Nevertheless, even ‘thick’ definitions of the Rule of Law may not capture all elements for 
ensuring confidence and trust in new surveillance technologies, because the mechanisms that 
allow measures to be appreciated as legitimate by data-subjects, and thereby generate trust in 
the application to ensure efficacy, are complex. Such complexity is even more relevant in crisis 
contexts where legality and legitimacy tend to decouple.?° 


(iii) | Contextualizing the application of the Rule of Law elements 


Because both the challenges to the Rule of Law and possible solutions thereof are context- 
dependent, it is important to contextualise the application of the Rule of Law principles identified 
and discussed in the previous sections. The presence of legal safeguards is important to the 
Rule of Law, but the proper implementation of the law is also a crucial aspect of the principle and 
must therefore also be taken into consideration. The implementation and enforcement of legal 
rules, however, are contingent upon social and institutional factors, as these will impact how 
social institutions absorb and implement laws within their existing network of social rules and 
contexts. 





= Philip A. Wallach, To the Edge: Legality, Legitimacy, and the Responses to the 2008 Financial Crisis. Washington, D.C.: 
Brookings Institution Press, 2015. Accessed March 19, 2021. http://www. jstor.org/stable/10.7864/j.ctt1 3wztk3. 
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